Code Injection Vulnerability in dataclasses-avroschema by Marcos Schroh

CVE-2026-108377

What is CVE-2026-108377?

The dataclasses-avroschema package, used for generating Avro schemas from Python dataclasses, is vulnerable to a code injection issue. The vulnerability arises from the handling of Avro record names in the ClassRepresentation.render_metaclass method. Specifically, the schema-controlled Avro record name can be inserted into the Meta.schema_name field without proper escaping, allowing an attacker to terminate the string literal. This can lead to malicious code being injected into the generated class body and executed upon importing the generated module. The issue has been addressed in version 0.70.6, which ensures proper escaping of these schema values.

References